Anthropic traced 151 million Claude exchanges to a 3,500-account fraud network it links to Alibaba
Anthropic says six campaigns since February 2026 pulled reasoning transcripts out of Claude through proxy relays built on fictitious identities, stolen credit cards, and API keys harvested from legitimate companies and individuals.
The Watch · Security desk
What happened
- Anthropic said on Thursday it identified and disrupted industrial-scale illicit distillation against Claude by seven China-based labs, including Alibaba, Moonshot, DeepSeek, Z.ai and MiniMax.
- The largest campaign, GTG-16005, ran 151 million exchanges between May and July 2026 against the chain-of-thought reasoning transcripts of Claude Opus 4.6 and 4.7.
- Xiaomi replayed user conversations and coding sessions from its MiMo models into Claude through the OpenClaw and OpenCode harnesses over 20 days in March and April 2026, Anthropic said.
Why it matters
- Who's exposed exposure Companies that never bought Claude are inside this incident through their own stolen API keys, and the enforcement action that stops the relay is what burns the key.
- What it limits constraint Volume alarms and per-account rate limits do not see a network that spreads its traffic thinly across thousands of identities, so anyone selling metered API access needs payment and identity analytics to find it.
- Who has to decide decision Any organisation that allowed Kimi or DeepSeek internally now has to decide whether prompts sent during those windows count as disclosure to a vendor it never contracted with.
- What doesn't add up contradiction The campaign labels, the volumes and the account counts rest on one vendor's telemetry, and none of the seven named labs has put its own account of the same traffic on the record.
Next story · Invest · Sep 23
Zhipu fell four times as far as Tencent on Beijing's DeepSeek data probeConfirmed3 publishers
Divide the peak volumes by the account counts and two different operations appear. GTG-16005 ran roughly 3 million exchanges a day across more than 3,500 fraudulent accounts [5], about 857 per account per day [20]. Moonshot's network moved almost 300,000 customer requests in ten days through 5,380 accounts [7], about six per account per day [21]. The first figure shows up in rate limiting. The second looks like ordinary paying customers, and catching it means looking at how the accounts were opened and paid for [12].
Five of the six campaigns carry volumes: 151 million [3], 23 million [6], more than 12.1 million [8], more than 3.4 million from Zhipu's 273 rotating accounts [9], and more than 400,000 from Xiaomi [10]. That is at least 189.9 million exchanges [25]. The sixth, GTG-16012, has no exchange count, because Anthropic says SenseTime bought the transcripts from third-party data vendors instead of generating them [11].
The access path is the part that reaches outside the AI industry. Anthropic said the relays were built on accounts created under fictitious identities, with fake or stolen credit cards and illegally harvested API keys belonging to legitimate companies or individuals [12]. A harvested key does not stop belonging to its owner. Requests made with it arrive at Anthropic under the owner's identity [22].
Traffic also moved the other way, into Claude, carrying other people's prompts. "DeepSeek, Xiaomi, and Moonshot fed conversations between their own models and users into Claude," Anthropic said [14]. Moonshot, on Anthropic's account, rerouted its own customers' requests away from Kimi and displayed Claude's responses back to them [6]. Anthropic said "Some of these exchanges included sensitive information, including from individual users, major multinational companies, and state-affiliated actors." [15]
Seven labs are named [1] and six campaigns described [2]. The campaign detail covers Alibaba, Moonshot, DeepSeek, Zhipu, Xiaomi and SenseTime; MiniMax is in the list of seven without an attributed campaign [23]. Every volume, date range and account count here comes from Anthropic's own telemetry, and no response from any named lab appears in the reporting [24]. Google and OpenAI have made the same accusation about their own models before [17].
What to watch
- A response on the record from Alibaba, Moonshot, DeepSeek, Zhipu, Xiaomi, SenseTime or MiniMax to the campaign attributions.
- Whether Anthropic tells the companies whose harvested API keys were pooled into the relay networks, and publishes anything they can check against.
- Whether Google or OpenAI publish per-campaign exchange volumes and account counts for their own models.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+20
- Incentives65
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Anthropic said on Thursday it identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, including Alibaba, Moonshot, DeepSeek, Z.ai (aka Zhipu) and MiniMax.
- [2]
Since February 2026, Anthropic said it has detected six illicit distillation campaigns conducted by China-based AI labs to advance their own models.
- [3]
GTG-16005: 151 million exchanges observed between May and July 2026, in which a cluster of Alibaba-affiliated operators targeted the chain-of-thought reasoning transcripts of Claude Opus 4.6 and 4.7.
- [4]
Anthropic described GTG-16005 as the "largest distillation attack we have ever measured".
- [5]
GTG-16005 peaked at roughly 3 million exchanges per day launched from more than 3,500 fraudulent accounts, targeting agentic tasks, software engineering, kernel development and long-horizon tasks.
- [6]
GTG-16002: 23 million exchanges observed between May and July 2026, in which Moonshot AI stealthily rerouted customer requests to Claude rather than processing them with Kimi, displayed Claude's responses to users, and captured a subset of the exchanges to train its chain-of-thought model.
- [7]
Over a 10-day period Moonshot is said to have relayed almost 300,000 customer requests to Anthropic using a proxy service network of 5,380 fraudulent accounts, most of them located in Singapore and Japan.
- [8]
GTG-16001: more than 12.1 million exchanges observed over 14 days in July 2026, in which DeepSeek silently relayed exchanges to Claude without informing its customers and extracted chain-of-thought transcripts.
- [9]
GTG-16006: more than 3.4 million exchanges observed over 17 days in June and July 2026, in which Zhipu (Z.ai) ran a chain-of-thought extraction pipeline and replayed Claude reasoning traces through Claude, rotating through 273 fraudulent accounts.
- [10]
GTG-16008: more than 400,000 exchanges observed over 20 days in March and April 2026, in which Xiaomi replayed user conversations and coding sessions from its own MiMo models to Claude through the OpenClaw and OpenCode coding harnesses.
- [11]
GTG-16012: SenseTime purchased transcripts of user exchanges with Claude from third-party data vendors.
- [12]
Anthropic said the labs generally gain access to its models by routing requests through proxy services, also called transfer or relay stations, which create thousands of new accounts under fictitious identities, fake or stolen credit cards, and illegally harvested API keys belonging to legitimate companies or individuals.
- [13]
"In other cases, unauthorized labs rerouted requests from their users to Claude -- without the knowledge or permission of those users -- to harvest exchanges between users and Claude for training," Anthropic said.
- [14]
"DeepSeek, Xiaomi, and Moonshot fed conversations between their own models and users into Claude," Anthropic said.
- [15]
"Some of these exchanges included sensitive information, including from individual users, major multinational companies, and state-affiliated actors," Anthropic said.
- [16]
Anthropic said unauthorized AI labs also acquire transcripts of user exchanges with U.S. frontier models by buying them from third-party resellers, who operate proxy services that save such conversations without the users' knowledge or consent.
- [17]
Frontier AI labs in the West, including Google and OpenAI, have repeatedly called out distillation attacks aimed at their models.
- [18]
Knowledge distillation by itself is a legitimate training method in which a large teacher model trains a smaller or faster student model to copy its capabilities.
- [19]
Anthropic said it observed unauthorized labs using "increasingly sophisticated methods" to get around defenses and harvest capabilities including agentic capabilities and tool use, coding and data analysis, and logical reasoning, through prompt manipulation tricks.
- [20]
At its peak, GTG-16005 averaged about 857 exchanges per fraudulent account per day.
- [21]
Moonshot's relayed traffic averaged about six requests per fraudulent account per day.
- [22]
Requests made with an illegally harvested API key reach Anthropic under the identity of the legitimate company or individual that owns the key.
- [23]
Six of the seven labs Anthropic names have a described campaign (Alibaba, Moonshot, DeepSeek, Zhipu, Xiaomi, SenseTime); MiniMax appears in the list without an attributed campaign.
- [24]
The published account contains no statement or response from any of the seven named labs; every volume, date range and account count is attributed to Anthropic.
- [25]
The five campaigns with published volumes total at least 189.9 million exchanges.
Sources
2 independent publishers whose own reporting we read for this story.
- blockchain.newsAnthropic: Chinese Labs Used Claude Data for Training | Flash News Detail | Blockchain.News
1 article · September 10, 2026
- thehackernews.comAnthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks
2 articles · September 12, 2026